Calico Kernel's RPF check is set to 'loose'

前言

K8s 集群部署使用了 calico 网络插件，而calico node 节点发生如下报错：

2023-03-13 11:19:36.622 [FATAL][828] int_dataplane.go 1032: Kernel's RPF check is set to 'loose'.
This would allow endpoints to spoof their IP address.
Calico requires net.ipv4.conf.all.rp_filter to be set to 0 or 1.
If you require loose RPF and you are not concerned about spoofing,
this check can be disabled by setting the IgnoreLooseRPF configuration parameter to 'true'.

解决方法有两种：

• Calico requires net.ipv4.conf.all.rp_filter to be set to 0 or 1.
• this check can be disabled by setting the IgnoreLooseRPF configuration parameter to 'true'.

第一种

修改内核参数

sysctl net.ipv4.conf.all.rp_filter=0

第二种

kubectl -n kube-system set env daemonset/calico-node FELIX_IGNORELOOSERPF=true